Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07/04/2024, 00:08

General

  • Target

    a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace.exe

  • Size

    360KB

  • MD5

    5734fa65edfa6c4e36b2f28d895a6ead

  • SHA1

    61f2a6be3b86be4b2e220a77c0700b31f8316c34

  • SHA256

    a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace

  • SHA512

    edf56f844af0ead3080974c7f8a551cffe5a97399ee9817ab3bacbbd43ec0d47453cfeae467e1d8c34945ba7fa03b56b36981c1002cfded1df96a1a0ea715cfe

  • SSDEEP

    6144:vhbZ5hMTNFf8LAurlEzAX7oAwfSZ4sXUzQIL9:ZtXMzqrllX7XwfEIB

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 26 IoCs
  • Loads dropped DLL 52 IoCs
  • UPX packed file 52 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 26 IoCs
  • Modifies registry class 54 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace.exe
    "C:\Users\Admin\AppData\Local\Temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1288
    • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202.exe
      c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2300
      • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202a.exe
        c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202a.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2528
        • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202b.exe
          c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202b.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:2556
          • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202c.exe
            c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202c.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:2600
            • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202d.exe
              c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202d.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:2424
              • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202e.exe
                c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202e.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Adds Run key to start application
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:2736
                • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202f.exe
                  c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202f.exe
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Adds Run key to start application
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:1552
                  • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202g.exe
                    c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202g.exe
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Adds Run key to start application
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:1804
                    • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202h.exe
                      c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202h.exe
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Adds Run key to start application
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:2712
                      • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202i.exe
                        c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202i.exe
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Adds Run key to start application
                        • Modifies registry class
                        • Suspicious use of WriteProcessMemory
                        PID:2372
                        • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202j.exe
                          c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202j.exe
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Adds Run key to start application
                          • Modifies registry class
                          • Suspicious use of WriteProcessMemory
                          PID:1240
                          • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202k.exe
                            c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202k.exe
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Adds Run key to start application
                            • Modifies registry class
                            • Suspicious use of WriteProcessMemory
                            PID:1300
                            • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202l.exe
                              c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202l.exe
                              14⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Adds Run key to start application
                              • Modifies registry class
                              • Suspicious use of WriteProcessMemory
                              PID:1316
                              • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202m.exe
                                c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202m.exe
                                15⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Adds Run key to start application
                                • Modifies registry class
                                • Suspicious use of WriteProcessMemory
                                PID:2288
                                • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202n.exe
                                  c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202n.exe
                                  16⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Adds Run key to start application
                                  • Modifies registry class
                                  • Suspicious use of WriteProcessMemory
                                  PID:3000
                                  • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202o.exe
                                    c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202o.exe
                                    17⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Adds Run key to start application
                                    • Modifies registry class
                                    PID:2320
                                    • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202p.exe
                                      c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202p.exe
                                      18⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Adds Run key to start application
                                      • Modifies registry class
                                      PID:944
                                      • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202q.exe
                                        c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202q.exe
                                        19⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Adds Run key to start application
                                        • Modifies registry class
                                        PID:968
                                        • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202r.exe
                                          c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202r.exe
                                          20⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Adds Run key to start application
                                          • Modifies registry class
                                          PID:1772
                                          • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202s.exe
                                            c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202s.exe
                                            21⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Adds Run key to start application
                                            • Modifies registry class
                                            PID:844
                                            • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202t.exe
                                              c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202t.exe
                                              22⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Adds Run key to start application
                                              • Modifies registry class
                                              PID:2948
                                              • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202u.exe
                                                c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202u.exe
                                                23⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Adds Run key to start application
                                                • Modifies registry class
                                                PID:668
                                                • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202v.exe
                                                  c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202v.exe
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Adds Run key to start application
                                                  • Modifies registry class
                                                  PID:2996
                                                  • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202w.exe
                                                    c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202w.exe
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Adds Run key to start application
                                                    • Modifies registry class
                                                    PID:836
                                                    • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202x.exe
                                                      c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202x.exe
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Adds Run key to start application
                                                      • Modifies registry class
                                                      PID:2856
                                                      • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202y.exe
                                                        c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202y.exe
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Modifies registry class
                                                        PID:2992

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202k.exe

    Filesize

    360KB

    MD5

    7e6b4a3b7df69f2517eb1170cf5158ee

    SHA1

    8b792b75e06af14fab087bafaab85acb1bc7f9eb

    SHA256

    96c97aa16eb90658ed82ca9d55695cf10e97c93f632ae671351055f92f180d2e

    SHA512

    f3ab9fc830caff4c98f5136da57ef9bad76310505ac7c5e8c2103fe566e7b9ed82dadb8b51080956c9545b0d19f5e999180c26302fba7180c7b897929c17a028

  • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202e.exe

    Filesize

    360KB

    MD5

    231399dfaf87515554323d64bbc81edb

    SHA1

    e3f999e0445e49b017232a38db83b63402c5ceff

    SHA256

    50f036a02ba81112732cf85481ac7f4f11c80ae31efd947e628f38489d1d6398

    SHA512

    327a0d206371b0ee12ddf45bc3ec0efa94e5ed8097690fb39a1e3ce245a3c8430fc83f30abe6231ddddfcfae7b4aeb336439c78377edc6cc9f31aa49b3cc6cde

  • \Users\Admin\AppData\Local\Temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202.exe

    Filesize

    360KB

    MD5

    af7d1de290f6c47d9a63de13b9d50795

    SHA1

    689aa36ccc3636e77763efee8cd873ba8515fea5

    SHA256

    08c639502e460293d62f2266bee7a08c062228e5ccc45114b4e4402010c57a15

    SHA512

    3058c8ed730d897f464f8f106b876e19271725155ad50a66bf75ae7c86a0d783fe63979f2d2ab1ff2306c222702b25d5765def7876b96ece65e2cf9cc43bd204

  • memory/668-334-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/668-333-0x0000000000220000-0x000000000025A000-memory.dmp

    Filesize

    232KB

  • memory/844-300-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/844-311-0x0000000001C10000-0x0000000001C4A000-memory.dmp

    Filesize

    232KB

  • memory/844-310-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/944-269-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/944-275-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/944-271-0x0000000000350000-0x000000000038A000-memory.dmp

    Filesize

    232KB

  • memory/968-281-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/968-286-0x0000000000220000-0x000000000025A000-memory.dmp

    Filesize

    232KB

  • memory/968-287-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1240-187-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1240-182-0x0000000000220000-0x000000000025A000-memory.dmp

    Filesize

    232KB

  • memory/1240-179-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1288-12-0x0000000000220000-0x000000000025A000-memory.dmp

    Filesize

    232KB

  • memory/1288-0-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1288-13-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1300-204-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1300-199-0x0000000000330000-0x000000000036A000-memory.dmp

    Filesize

    232KB

  • memory/1300-195-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1300-288-0x0000000000330000-0x000000000036A000-memory.dmp

    Filesize

    232KB

  • memory/1316-219-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1316-212-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1552-196-0x0000000000280000-0x00000000002BA000-memory.dmp

    Filesize

    232KB

  • memory/1552-122-0x0000000000280000-0x00000000002BA000-memory.dmp

    Filesize

    232KB

  • memory/1552-123-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1552-115-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1772-299-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1772-294-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1804-139-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1804-131-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2288-227-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2288-235-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2288-234-0x00000000002C0000-0x00000000002FA000-memory.dmp

    Filesize

    232KB

  • memory/2300-28-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2300-21-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2320-258-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2320-263-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2372-171-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2372-170-0x00000000001C0000-0x00000000001FA000-memory.dmp

    Filesize

    232KB

  • memory/2372-162-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2424-83-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2424-165-0x0000000001CE0000-0x0000000001D1A000-memory.dmp

    Filesize

    232KB

  • memory/2424-91-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2424-86-0x0000000001CE0000-0x0000000001D1A000-memory.dmp

    Filesize

    232KB

  • memory/2528-36-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2528-44-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2528-39-0x0000000000220000-0x000000000025A000-memory.dmp

    Filesize

    232KB

  • memory/2556-52-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2556-59-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2600-74-0x0000000000220000-0x000000000025A000-memory.dmp

    Filesize

    232KB

  • memory/2600-75-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2600-153-0x0000000000220000-0x000000000025A000-memory.dmp

    Filesize

    232KB

  • memory/2600-67-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2712-154-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2712-146-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2736-114-0x00000000002C0000-0x00000000002FA000-memory.dmp

    Filesize

    232KB

  • memory/2736-94-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2736-107-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2948-317-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2948-323-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2948-322-0x0000000000440000-0x000000000047A000-memory.dmp

    Filesize

    232KB

  • memory/3000-250-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/3000-243-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB